Hey @splunker969, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @nagaruju_chittathuru, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @Naren26, if @niketnilay solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Hey @kennethyeung, if they solved your problem, remember to "√Accept" an answer to award karma points 🙂 ... View more

Would your TA work for this, @pdoconnell? ... View more

Dear @msg64, Please ensure to use the appropriate buttons when adding answers or comments. The Add Comment field can be found below answers and right below your question. As well, if you submit a post and do not see it immediately, please wait a while before re-posting. At times posts are sent to the moderation queue for review. In this case, multiple attempts were sent to our moderation queue. I went ahead and approved the answer, converted it to a comment, and rejected the other attempts. ... View more

Hey @sancharigupta, can you let us know what version of Splunk you were using and more about your environment? That might help people diagnose further. Thanks! ... View more

Hey @pyde88 - Can you let us know which apps specifically? ... View more

@networkthinking -- re your comment "not able to award points" -- are you able to "Accept" the answer? If not we can file a bug report. Let me know! ... View more

Hey @shiva2007, please remember to post your comments as comments. I just converted this post from an answer. As well, since this post is over one year old it could help to post a new question with your issue. ... View more

Hey @gsypsomos, The buckets don't roll until the last record of each bucket reaches the time specified, so that might be your issue (RE: That setting is supposed to remove anything over 1.25 years old in my data.). As for eliminating the warm bucket and frozen bucket -- you can change your configuration files on those, but I believe the rule of thumb is to definitely use the warm bucket because the search will check the time range on each bucket to see if it should search for results inside of the bucket and can skip the entire bucket if it does not fit that range. This wiki has some more info: https://wiki.splunk.com/Deploy:BucketRotationAndRetention ... View more

Hey @unixmit and @ssievert -- for the universal forwarder ARMv6 you can get it by going to the Linux options of the universal forwarder download page (from the menu at the bottom of the splunk.com website in the footer menu), or by clicking this link: https://www.splunk.com/en_us/download/universal-forwarder.html#tabs/linux I'm not sure what the Splunk Enterprise download is but as @ssievert said please provide the link so we or others can help you. ... View more

Hey @seancruikshankidelta, A product expert might have additional info for you about specific differences, but it looks like the Splunk Insights for AWS Cloud Monitoring is aimed at AWS customers who don't have a Splunk environment already and offers dashboards and solutions 'in a box' that make it really easy to monitor migrations to AWS using Splunk. ... View more

Hey @Moyad63, I'm checking in to see if I can get a typical ETA, but wanted to let you know that you can get started right away with the free Splunk Fundamentals 1 course if you'd like to learn about Splunk while that process is finalized. ... View more

Hey @jincy_18, if @jortonew's response solved your problem, please accept the answer to award karma points and to close the question. Happy Splunking! ... View more

Hey @Sbataccount if @garethatiag answered your question as needed please remember to accept the answer to close the question and to award karma points. 🙂 ... View more

Hi @DUThibault, I poked around and found a few resources to show the partnership between Splunk and Verizon: https://www.splunk.com/en_us/newsroom/press-releases/2016/verizon-and-splunk-join-forces-to-advance-threat-detection-for-enterprises.html Verizon Enterprise Solutions worked w/ Splunk to offer this product in Splunkbase. The app is in beta and Verizon is actively updating and enhancing the tool, and will continue to publish updated version with increased functionality and usability features. http://www.verizonenterprise.com/resources/analyst-reports/ar_frost-and-sullivan-new-product-innovation-award_en_xg.pdf ... View more

Hey @sarge338, welcome to the Splunk community! When you're responding to answers on Answer posts please use the comment feature rather than posting a new "answer". As well, if @sukisen1981 is able to find the solution for you please accept their answer so you can award karma points and close the question! 🙂 You can also upvote to award points. ... View more

Hey @mudragada, I hope you're having fun at .conf! I checked and it looks like the release date is TBD, but I pinged the speaker and will let you know if there's more info in a follow-up comment. ... View more

Hey @mschellhouse, If you have a question, share it with the community, then find a solution, then you should accept your own answer. 🙂 There will be more info as this is edited over time, but you can always reference the Answers documentation as well if you have questions about etiquette. http://docs.splunk.com/Documentation/Community/latest/community/AboutCommunity Happy Splunking! ... View more

Hey @markhvesta, your similar post came through the moderation queue, but please follow this post instead. Additional info from @markhvesta: "The log only references this same generic message, and when setting up the new input, the tables and schema for the new database connection are seen but the error is received before being able to select the input type" ... View more

Hey @frizzoS3, this can be read in docs: Correlation searches can run with a real-time or continuous schedule. • Use a real-time schedule to prioritize current data and performance. Searches with a real-time schedule are skipped if the search cannot be run at the scheduled time. Searches with a real-time schedule do not backfill gaps in data that occur if the search is skipped. • Use a continuous schedule to prioritize data completion, as searches with a continuous schedule are never skipped. As for guided vs. manual mode -- I think this is the difference, "Select a mode of Guided to create a search without having to write the search syntax yourself, or select Manual to write your own search." ... View more

Hey @heybails88, Can you repost this comment as a new question? Happy Splunking! ... View more

Hi @AlexeyNL, did you figure out a solution for this? ... View more

Hey @michaelrosello, It looks like this other Answers community member had the same error message: https://answers.splunk.com/answers/439461/why-am-i-unable-to-display-a-custom-tagcloud-visua.html ... View more